leftonconstruction.com

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 20.199.188.184, located in Zurich, Switzerland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is leftonconstruction.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 15th 2021. Valid for: 3 months.

This is the only time leftonconstruction.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	20.199.188.184 20.199.188.184	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2603:1026:c03... 2603:1026:c03:3032::2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	5

2 20.199.188.184 (Zurich, Switzerland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

leftonconstruction.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2603:1026:c03:3032::2 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

outlook.office365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	leftonconstruction.com 1 redirects leftonconstruction.com	16 KB
1	office365.com outlook.office365.com	3 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	20 KB
1	aspnetcdn.com ajax.aspnetcdn.com	43 KB
4	4

	Domain	Requested by
2	leftonconstruction.com	1 redirects
1	outlook.office365.com	leftonconstruction.com
1	maxcdn.bootstrapcdn.com	leftonconstruction.com
1	ajax.aspnetcdn.com	leftonconstruction.com
4	4

This site contains no links.

Subject Issuer	Validity	Valid
leftonconstruction.com cPanel, Inc. Certification Authority	`2021-08-15` - `2021-11-13`	3 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2020-11-16` - `2021-11-10`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
outlook.com DigiCert Cloud Services CA-1	`2020-07-02` - `2022-07-02`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://leftonconstruction.com/deep/
Frame ID: 2AB05FC52E7B32E6B1551BE3FB6B6A01
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://leftonconstruction.com/deep HTTP 301
https://leftonconstruction.com/deep/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

81 kB
Transfer

238 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://leftonconstruction.com/deep HTTP 301
https://leftonconstruction.com/deep/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
leftonconstruction.com/deep/
Redirect Chain

https://leftonconstruction.com/deep
https://leftonconstruction.com/deep/

15 KB
15 KB

59ms
58ms

Document
text/html

20.199.188.184
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://leftonconstruction.com/deep/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 20.199.188.184 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: bd569407f418d7e78c89b4bf1563ee314ba217a55251f4683cc8ca40e4f54087

Request headers

Host: leftonconstruction.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 15:57:46 GMT
Server: Apache
Last-Modified: Thu, 01 Aug 2019 08:59:02 GMT
Accept-Ranges: bytes
Content-Length: 15617
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Tue, 17 Aug 2021 15:57:46 GMT
Server: Apache
Location: https://leftonconstruction.com/deep/
Content-Length: 244
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 jquery-1.12.4.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 95 KB
43 KB 131ms
44ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.4.min.js

Requested by

Host: leftonconstruction.com
URL: https://leftonconstruction.com/deep/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ska/F6A4) /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://leftonconstruction.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:57:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3500597
x-cache: HIT
content-length: 43298
x-xss-protection: 1; mode=block
last-modified: Mon, 31 Oct 2016 23:10:52 GMT
server: ECAcc (ska/F6A4)
etag: "851dbc6cc33d21:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 15ms
14ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: leftonconstruction.com
URL: https://leftonconstruction.com/deep/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://leftonconstruction.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 15:57:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 632, 617
age: 12768837
cdn-cachedat: 2021-03-11 11:57:53
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: a31dd7f18bc0fe8277e68a4489d4861a
cf-ray: 6804199c58114a85-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H/1.1 200
OK liveid.png
outlook.office365.com/Encryption/ 3 KB
3 KB 106ms
63ms Image
image/png 2603:1026:c03:3032::2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://outlook.office365.com/Encryption/liveid.png
Requested by: Host: leftonconstruction.com
URL: https://leftonconstruction.com/deep/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2603:1026:c03:3032::2 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: da7b1e7c0e95a9caba46be191f562268cee236556f67e4b10f2b3a05785b9cad

Request headers

Referer: https://leftonconstruction.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

X-BEServer: AM5PR0202MB2610
Date: Tue, 17 Aug 2021 15:57:46 GMT
X-BackEndHttpStatus: 200
X-Proxy-BackendServerStatus: 200
X-Powered-By: ASP.NET
X-RUM-Validated: 1
request-id: e4492202-7c34-df96-82ec-4d1cfcde75fe
Content-Length: 2955
Server: Microsoft-IIS/10.0
Last-Modified: Sat, 12 May 2018 15:57:26 GMT
X-CalculatedBETarget: AM5PR0202MB2610.eurprd02.prod.outlook.com
ETag: "0b710ec9ead31:0"
Content-Type: image/png
Cache-Control: public,max-age=2592000
X-DiagInfo: AM5PR0202MB2610
X-Proxy-RoutingCorrectness: 1
Accept-Ranges: bytes
X-FEServer: AM0PR02CA0195

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d23cd32f81ea9cd9106ef132fe2d4b808fc8e336dcd986f24c75158c672ea2cb

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
leftonconstruction.com
maxcdn.bootstrapcdn.com
outlook.office365.com
152.199.19.160
20.199.188.184
2603:1026:c03:3032::2
2606:4700::6812:bcf
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
bd569407f418d7e78c89b4bf1563ee314ba217a55251f4683cc8ca40e4f54087
d23cd32f81ea9cd9106ef132fe2d4b808fc8e336dcd986f24c75158c672ea2cb
da7b1e7c0e95a9caba46be191f562268cee236556f67e4b10f2b3a05785b9cad
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

leftonconstruction.com Open in urlscan Pro 20.199.188.184 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

81 kBTransfer

238 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

0 Cookies

Indicators

leftonconstruction.com Open in urlscan Pro
20.199.188.184 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

81 kB
Transfer

238 kB
Size

0
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!